Skip to content
RU

DNS propagation in 2026: resolver speed and answer divergence

TL;DR. We queried five public resolvers for 600 domains and compared the answers.

We queried five public resolvers for 600 domains and compared the answers. For .org and .com domains resolvers diverge in 29–30% of cases; for .ru, in 4%.

It looks like an advantage and means the opposite: divergence is a trace of geographic DNS, that is, a sign of a CDN. Below: what can actually be measured about "propagation", each resolver’s speed with a caveat about the vantage point, and how to verify a migration properly.

Check your domain's DNS →

What "DNS propagation" actually measures

Propagation usually means the time it takes for a record change to reach every resolver. That quantity is not measured directly: it is set by the TTL of the previous answer, not by the speed of any server. If the old record carried an hour, an hour is how long it lives in caches — whoever you ask.

So two other things can be measured, and both are more useful: how fast each resolver answers and whether different resolvers give the same answer. The second is what people usually see when they say "mine has updated but my colleague’s hasn’t".

On 27 August 2026 we queried five public resolvers for 600 domains — 3,000 queries. From a single vantage point: Moscow, on the Selectel network.

Speed: from Moscow, Cloudflare answers fastest

ResolverMedianp90p99
Cloudflare 1.1.1.144 ms171 ms1,187 ms
Google 8.8.8.854 ms153 ms1,076 ms
OpenDNS 208.67.222.22282 ms189 ms547 ms
Quad9 9.9.9.984 ms183 ms774 ms
Yandex 77.88.8.888 ms303 ms814 ms

A caveat without which the table cannot be read: latency to a resolver is set by the network path from the measuring point, not by the resolver’s quality. These are numbers for one Moscow server on one network, and from elsewhere the order may differ. They are not a general ranking of resolvers.

Note the tail: OpenDNS has the worst median among the quick ones yet the shortest p99 — 547 ms against Cloudflare’s 1,187. For DNS that often matters more than the average: a one-second stall on a critical lookup is more noticeable than a steady extra forty milliseconds.

Empty answers came out alike across all five — 51 to 57 of 600, or 8–10%. That agreement is a good sign: every resolver concurs on which domains do not resolve at all, so the method is not skewed.

Divergence: .ru has almost none, and that is not about quality

We compared the address sets five resolvers returned for the same domain:

ZoneComparable domainsResolvers disagreedShare
.org1404230%
.com1374029%
.net1342619%
.ru13864%

At first glance this looks like an advantage for the Russian web: steadier answers. In fact the opposite holds, and the cause matters more than the figure.

Resolver divergence is almost always a trace of geographic DNS. A content delivery network deliberately returns different addresses to different resolvers so as to send a visitor to the nearest node. A domain behind such a CDN must give different answers — that is the whole point. A domain on one fixed address gives everyone the same one.

So the divergence rate measures CDN prevalence, not DNS quality. Four percent in .ru against thirty in .org is another measurement of the same fact we obtained from alt-svc headers and from short TTLs. Three independent signals, one conclusion.

How to check propagation properly

  1. Lower the TTL in advance. A day before a migration set five minutes and wait for the old value to expire. TTL cannot be shortened retroactively — it is the only lever, and it works only before the change.
  2. Do not panic at differing answers on a CDN-backed site. If a delivery network serves your domain, different resolvers should return different addresses. That is not a propagation fault.
  3. Check against the authoritative server, not a public resolver. Querying your NS directly shows what you have published; querying 8.8.8.8 shows what is cached. Those are different questions, and confusing them is the commonest source of a false alarm.
  4. Remember the cache on your own machine. The operating system and the browser cache separately from your provider, and "it hasn’t updated for me" often means exactly that.

To see how an answer varies across resolvers, use the propagation checker; for a domain’s full record set, the DNS lookup.

A / AAAAIPv4 and IPv6 host addresses
MX RecordsDomain mail servers
TXT / SPFVerification & anti-spoofing
NS / SOAName servers & zone authority

Why teams trust us

12
DNS record types
SPF+DKIM
email protection
<1s
DNS response
3
check regions

How it works

1

Enter domain

2

Select record type

3

Get DNS response

What are DNS Records?

DNS (Domain Name System) translates domain names into IP addresses. DNS records are instructions that define where to route traffic, email, and how to verify domainownership.

Complete Lookup

Query all record types — A, AAAA, MX, NS, TXT, CNAME, SOA — in a single request.

Instant Results

Direct queries to authoritative servers. Results in milliseconds, no caching.

Security Checks

SPF, DKIM, and DMARC analysis to evaluate email protection against spoofing and phishing.

Export & History

Save check results. Compare DNS records before and after registrar changes.

Who uses this

DevOps

DNS check after deploy

Email marketers

SPF/DKIM/DMARC audit

SEO

DNS config audit

Sysadmins

DNS zone control

Common Mistakes

Missing SPF recordWithout SPF, emails may land in spam. Add a v=spf1 TXT record.
Single NS serverIf the only NS fails, the domain becomes unreachable. Use at least 2 NS servers.
CNAME conflicting with other recordsCNAME cannot coexist with MX or TXT on the same name — this violates RFC.
TTL set too highWith 86400s TTL, DNS changes take a full day. Lower TTL to 300 before migrations.
Missing PTR recordMail servers check PTR. Without it, emails may be rejected.

Best Practices

Set up SPF + DKIM + DMARCThe trio of records that protects your email from spoofing and improves deliverability.
Use 2+ NS serversDistribute NS servers across different networks for redundancy.
Lower TTL before migrationSet TTL to 300 at least 24-48 hours before an IP change for fast propagation.
Verify DNS after changesAfter updating records, confirm changes propagated correctly and no errors remain.
Add a CAA recordCAA restricts which Certificate Authorities can issue SSL certificates for your domain.

Get more with a free account

DNS check history, API keys and DNS change monitoring.

Sign up free

Learn more

Frequently Asked Questions

Is data current?

Q1 2026. Updated quarterly.

Can I cite this?

Yes, with attribution to Enterno.io.

Try the live tool that powered this guide

Free plan — 10 monitors, checks every 5 min, no card required. Upgrade for 1-minute interval and multi-region monitoring.